Feat: ai gateway file convert by harshadixit12 · Pull Request #2137 · Kong/deck

harshadixit12 · 2026-07-08T13:44:50Z

Summary

In this PR, we are adding support for a new command deck file ai2kong which accepts a AI gateway declarative config, and converts it to kong 3.x format declarative config to be used with on prem AI Gateway.

Implements

#2148

codecov-commenter · 2026-07-14T08:58:02Z

Codecov Report

❌ Patch coverage is 20.29340% with 326 lines in your changes missing coverage. Please review.
✅ Project coverage is 35.95%. Comparing base (0808448) to head (9759b05).

Files with missing lines	Patch %	Lines
cmd/ai_sync.go	0.00%	92 Missing ⚠️
cmd/ai_dump.go	11.45%	83 Missing and 2 partials ⚠️
tests/integration/test_utils.go	0.00%	62 Missing ⚠️
cmd/ai.go	51.47%	25 Missing and 8 partials ⚠️
cmd/common.go	0.00%	26 Missing ⚠️
cmd/file_ai2kong.go	71.15%	7 Missing and 8 partials ⚠️
cmd/gateway_dump.go	0.00%	8 Missing ⚠️
cmd/root.go	0.00%	5 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2137      +/-   ##
==========================================
- Coverage   36.69%   35.95%   -0.75%     
==========================================
  Files          78       82       +4     
  Lines        7429     7827     +398     
==========================================
+ Hits         2726     2814      +88     
- Misses       4457     4748     +291     
- Partials      246      265      +19

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Prashansa-K · 2026-07-14T10:19:54Z

+	// Print warnings to stderr
+	if len(warnings) > 0 {
+		for _, warning := range warnings {
+			fmt.Fprintf(os.Stderr, "Warning: %v\n", warning)


This would break json output, right?
Are we concerned about that right now?

I see that we are using YAML everywhere for now. We can revisit this later. Let's add a TODO comment on top so that we don't miss this when we add JSON support.

Ideally - yes, we should - but i'll get to this once all PRs have been merged.

Prashansa-K · 2026-07-14T10:21:28Z

+		return fmt.Errorf("failed to read source file: %w", err)
+	}
+
+	converted, warnings, err := convert.Convert(sourceContent, convert.Options{


nitpick: Can we import this as ai2kong and call ai2kong.Convert()?
It will be more verbose and avoid the confusing repetition.

Prashansa-K · 2026-07-14T10:22:06Z

+}
+
+func validateAi2KongFlags(_ *cobra.Command, _ []string) error {
+	if convertSourceFile == "" {


We can take only one file at a time for conversion, right?
If yes, can we add a validation for that too.

For flag type of string - cobra follows "last value" wins - so additional validation is not needed. (same in openapi2kong)

Prashansa-K · 2026-07-14T10:24:07Z

+	if docMap, ok := doc.(map[string]interface{}); ok {
+		if infoMap, ok := docMap["_info"].(map[string]interface{}); ok {
+			// _info exists, update select_tags
+			infoMap["select_tags"] = []string{"managed-by:deck-ai"}


This can over-write the existing select-tags.

This is converting an ai gateway file -> deck, the ai gateway file won't have select tags at global level

Prashansa-K · 2026-07-14T10:25:41Z

+		} else {
+			// _info doesn't exist, create it with select_tags
+			docMap["_info"] = map[string]interface{}{
+				"select_tags": []string{"managed-by:deck-ai"},


managed-by:deck-ai should be a constant

Elsewhere, the convention I have seen is managed_by. Should we follow that or is this one a request from product?

Will be made constant - this was a suggestion, not a request. I'll update it to managed_by.

Prashansa-K · 2026-07-14T10:27:52Z

+	cmd := &cobra.Command{
+		Use:     "ai2kong",
+		Short:   "Generate Kong configuration from AI Gateway configuration",
+		Long:    `This command takes an AI Gateway 2.0 entity model and converts it to a standard decK state file`,


Since we are adding a tag ourselves for our internal working, I think we should explicitly call that out in the description. It will help endusers to know that the tag addition is expected and they shouldn't remove it.

Prashansa-K · 2026-07-14T10:30:14Z

+	}
+
+	// Parse the converted YAML to add select_tags to _info
+	var doc interface{}


nit: I feel L64 to L81 can be abstracted out in a different function.

Prashansa-K · 2026-07-14T10:31:32Z

+		defer outFile.Close()
+		outputWriter = outFile
+	} else {
+		outputWriter = os.Stdout


This can be the default IMO rather than adding a nesting here with else.

Prashansa-K · 2026-07-14T10:43:57Z

+}
+
+// marshalToYAML encodes v as YAML using a two-space indent.
+func marshalToYAML(v interface{}) ([]byte, error) {


Any reason for a separate func for this?

Prashansa-K · 2026-07-14T10:47:31Z

+			err = yaml.Unmarshal([]byte(output), &currentOutput)
+			require.NoError(t, err)
+
+			assert.Equal(t, expectedOutput, currentOutput)


Should we consider syncing the output to an ai gateway for validity?
We need to support the decomposed flow as well.

I was planning to do that in the tests for sync and dump in the chained PR

Prashansa-K · 2026-07-15T11:26:26Z

+var (
+	convertSourceFile string
+	convertOutputFile string
+	managedByTag      = "managed_by:deck-ai"


renamed this in the chained PR and made it a const - 25fdbde

aikido-pr-checks · 2026-07-21T11:50:39Z

+		}
+
+		for _, f := range files {
+			content, err := os.ReadFile(f)


Potential file inclusion attack via reading file - high severity
If an attacker can control the input leading into the ReadFile function, they might be able to read sensitive files and launch further attacks with that information.

Suggested change

content, err := os.ReadFile(f)

if strings.Contains(f, "..") {

return nil, fmt.Errorf("invalid file path")

}

content, err := os.ReadFile(f)

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

aikido-pr-checks · 2026-07-21T11:50:40Z

+        with:
+          egress-policy: audit
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0


GitHub Action actions/checkout persist Git credentials in workflow - low severity
actions/checkout v2 and above persist the default GITHUB_TOKEN in the repository's local git config when persist-credentials is not set to false, during the workflow run. Subsequent workflow steps or third-party actions can read this token from git configuration, increasing the risk of credential theft or misuse within the pipeline. In order to limit the attack surface when external actions are compromised, ensure persist-credentials is set to false.

Show fix

Remediation: Set persist-credentials: false on actions/checkout steps that do not need to push commits back to the repository. Only keep persist-credentials: true when the workflow explicitly performs authenticated git push operations.

_{Reply @AikidoSec ignore: [REASON] to ignore this issue.}
_{More info}

* feat: support diff and dump * style: lint-fix * fix: error out if syncing to konnect * fix: use positional arg for ai sync * fix: written format version in dump * fix: add go.work and go.work.sum to gitignore * chore: remove go.work and go.work.sum from tracking * tests: add integration tests for sync and dump * ci: add integration test workflow for ai-gateway * fix: rename tag and rebase with file ai2kong * tests: use new rc, add more tests * fix: avoid adding global tags in ai gateway format * fix: address feedback * chore: bump go-kong and go-database-reconciler * fix: optimise checking for ai select tag * fix: remove db propagation delay flag and add more tests for tag matching * Feat/support json and multi file sync (#2158) * feat: support json in ai2kong, ai sync and ai dump * feat: support syncing multiple files * style: refactor based on self review

harshadixit12 · 2026-07-21T17:35:53Z

@Prashansa-K need review on 3 new commits -
f7f5841
a68ee04
9759b05

harshadixit12 changed the title ~~Feat/ai gateway file convert~~ Feat: ai gateway file convert Jul 14, 2026

harshadixit12 marked this pull request as ready for review July 14, 2026 09:01

harshadixit12 requested a review from Prashansa-K July 14, 2026 09:01

Prashansa-K reviewed Jul 14, 2026

View reviewed changes

Prashansa-K reviewed Jul 15, 2026

View reviewed changes

Prashansa-K previously approved these changes Jul 17, 2026

View reviewed changes

harshadixit12 dismissed Prashansa-K’s stale review via 17e8b7c July 21, 2026 11:49

aikido-pr-checks Bot reviewed Jul 21, 2026

View reviewed changes

harshadixit12 added 11 commits July 21, 2026 17:22

feat: add file ai2kong skeleton and flags

7d0ceff

feat: add file ai2kong command

b249011

tests: add integration tests

05bcab8

feat: give global select tags as input to ai-deck-convert

8b2014e

tests: add integration tests for deck file ai2kong

3f895c7

fix: move select tag addition to decK and fix test output file

255d49f

fix: remove space in tag added and fix tests

2dd9dcd

style: lint fix

c3ab6b0

fix: ai-deck-converter should be direct dependency

ad73a62

fix: review feedback

1eeb766

chore: bump ai-deck-converter to latest and update tests

1d40e4f

harshadixit12 added 2 commits July 21, 2026 17:23

tests: add tests for multiple file ai sync and json input

f7f5841

harshadixit12 force-pushed the feat/ai-gateway-file-convert branch from 17e8b7c to f7f5841 Compare July 21, 2026 12:39

harshadixit12 added 2 commits July 21, 2026 18:25

chore: use latest ai-deck-converter

a68ee04

chore: use rc3 of ai gateway

9759b05

Prashansa-K approved these changes Jul 22, 2026

View reviewed changes

harshadixit12 merged commit 3cd9bc8 into main Jul 22, 2026
49 checks passed

harshadixit12 deleted the feat/ai-gateway-file-convert branch July 22, 2026 03:53

Uh oh!

Conversation

harshadixit12 commented Jul 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implements

Uh oh!

codecov-commenter commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aikido-pr-checks Bot Jul 21, 2026

Choose a reason for hiding this comment

Uh oh!

harshadixit12 commented Jul 21, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

harshadixit12 commented Jul 8, 2026 •

edited

Loading

codecov-commenter commented Jul 14, 2026 •

edited

Loading

aikido-pr-checks Bot Jul 21, 2026 •

edited

Loading